Skip to content

Conversation

@tcrespog
Copy link
Contributor

@tcrespog tcrespog commented Aug 7, 2025

Description

  • Add permission to GHA actions that did not have them (considered a vulnerability).

Guidelines for testing

  • The GHA actions work correctly.

Copy link

@daria-seqera daria-seqera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are some other workflows that don't have explicit permissions either (test-backend, frontend-pr-checks, some others), so why only add it to these two?

@tcrespog
Copy link
Contributor Author

tcrespog commented Aug 7, 2025

There are some other workflows that don't have explicit permissions either (test-backend, frontend-pr-checks, some others), so why only add it to these two?

A global config seems to apply for those:

permissions:
contents: read
packages: read
actions: read

@tcrespog tcrespog merged commit f4b76ce into master Aug 7, 2025
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants